nextly 0.0.1 → 0.0.2-alpha.0

package/dist/chunk-UJ2IMJ4W.mjs

@@ -0,0 +1,133 @@
+// src/shared/lib/env.ts
+import { z } from "zod";
+var _envSchema = z.object({
+  // Runtime
+  NODE_ENV: z.enum(["development", "production", "test"]).default("development"),
+  // Database
+  DB_DIALECT: z.enum(["postgresql", "mysql", "sqlite"]).default("postgresql"),
+  // Optional by default to allow sqlite file paths; validated conditionally below
+  DATABASE_URL: z.string().optional(),
+  // SQLite-specific path (alternative to DATABASE_URL for SQLite)
+  SQLITE_PATH: z.string().optional(),
+  // Pooling & timeouts
+  DB_POOL_MAX: z.coerce.number().int().min(1).default(20),
+  DB_POOL_MIN: z.coerce.number().int().min(0).default(2),
+  DB_POOL_IDLE_TIMEOUT: z.coerce.number().int().min(1e3).default(3e4),
+  DB_QUERY_TIMEOUT: z.coerce.number().int().min(1e3).default(15e3),
+  DB_HEALTHCHECK_INTERVAL_MS: z.coerce.number().int().min(1e3).default(3e4),
+  DB_SNAKE_CASE: z.coerce.boolean().default(false),
+  // URLs
+  NEXT_PUBLIC_APP_URL: z.string().url().optional(),
+  API_BASE_URL: z.string().url().default("http://localhost:3000/api"),
+  // Nextly auth secret (required in production, min 32 chars)
+  NEXTLY_SECRET: z.string().optional(),
+  // Additional allowed origins for CSRF validation (comma-separated)
+  NEXTLY_ALLOWED_ORIGINS: z.string().optional(),
+  // SMTP (Email provider)
+  SMTP_HOST: z.string().optional(),
+  SMTP_PORT: z.coerce.number().int().min(1).max(65535).default(587),
+  SMTP_USER: z.string().optional(),
+  SMTP_PASS: z.string().optional(),
+  SMTP_FROM: z.string().email().optional()
+}).superRefine((val, ctx) => {
+  const isProd = val.NODE_ENV === "production";
+  if (isProd) {
+    if (!val.NEXTLY_SECRET || val.NEXTLY_SECRET.length < 32) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["NEXTLY_SECRET"],
+        message: "In production, NEXTLY_SECRET of at least 32 characters is required."
+      });
+    }
+    if (!val.NEXT_PUBLIC_APP_URL) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["NEXT_PUBLIC_APP_URL"],
+        message: "In production, NEXT_PUBLIC_APP_URL is required."
+      });
+    }
+    const anySmtpProvided = Boolean(
+      val.SMTP_HOST || val.SMTP_USER || val.SMTP_PASS || val.SMTP_FROM
+    );
+    if (anySmtpProvided) {
+      const missingSmtp = !val.SMTP_HOST || !val.SMTP_USER || !val.SMTP_PASS || !val.SMTP_FROM;
+      if (missingSmtp) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          path: ["SMTP_FROM"],
+          message: "SMTP configuration is partially provided. When using Email in production, set SMTP_HOST, SMTP_USER, SMTP_PASS, and SMTP_FROM."
+        });
+      }
+    }
+  }
+  const dialect = val.DB_DIALECT;
+  if (dialect !== "sqlite") {
+    if (!val.DATABASE_URL) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["DATABASE_URL"],
+        message: `DATABASE_URL is required for ${dialect} dialect.`
+      });
+    }
+  }
+  if (val.DATABASE_URL) {
+    try {
+      new URL(val.DATABASE_URL);
+    } catch {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["DATABASE_URL"],
+        message: "DATABASE_URL must be a valid URL."
+      });
+    }
+  }
+  if (dialect === "sqlite" && !val.DATABASE_URL && !val.SQLITE_PATH) {
+    if (!isProd) {
+      console.warn(
+        "\u26A0\uFE0F  Neither DATABASE_URL nor SQLITE_PATH set for SQLite. Defaulting to file:./data/nextly.db"
+      );
+    }
+  }
+});
+function validateEnv() {
+  const parsed = _envSchema.safeParse(process.env);
+  if (!parsed.success) {
+    console.error("Environment validation failed:");
+    parsed.error.issues.forEach((issue) => {
+      console.error(`  ${issue.path.join(".")}: ${issue.message}`);
+    });
+    throw new Error("Invalid environment configuration");
+  }
+  const data = parsed.data;
+  const allowedOrigins = data.NEXTLY_ALLOWED_ORIGINS ? data.NEXTLY_ALLOWED_ORIGINS.split(",").map((s) => s.trim()).filter(Boolean) : [];
+  const normalized = Object.freeze({
+    ...data,
+    NEXTLY_ALLOWED_ORIGINS_PARSED: allowedOrigins
+  });
+  return normalized;
+}
+var _cachedEnv = null;
+function getValidatedEnv() {
+  if (!_cachedEnv) {
+    _cachedEnv = validateEnv();
+  }
+  return _cachedEnv;
+}
+var env = new Proxy({}, {
+  get(_, prop, receiver) {
+    return Reflect.get(getValidatedEnv(), prop, receiver);
+  },
+  has(_, prop) {
+    return Reflect.has(getValidatedEnv(), prop);
+  },
+  ownKeys() {
+    return Reflect.ownKeys(getValidatedEnv());
+  },
+  getOwnPropertyDescriptor(_, prop) {
+    return Reflect.getOwnPropertyDescriptor(getValidatedEnv(), prop);
+  }
+});
+
+export {
+  env
+};

package/dist/chunk-UOP63Q54.mjs

@@ -0,0 +1,102 @@
+import {
+  CreatePermissionSchema,
+  ServiceContainer
+} from "./chunk-NSEFNNU4.mjs";
+
+// src/database/seeders/permissions.ts
+var RESOURCES = ["users", "roles", "permissions"];
+var ACTIONS = ["create", "read", "update", "delete"];
+async function seedPermissions(adapter, options) {
+  const {
+    resources = RESOURCES,
+    actions = ACTIONS,
+    silent = false
+  } = options || {};
+  const log = silent ? () => {
+  } : console.log;
+  const errorLog = silent ? () => {
+  } : console.error;
+  log("\u{1F331} Starting permission seeding...\n");
+  if (typeof adapter.getDrizzle !== "function") {
+    throw new Error(
+      `Seeding not supported for adapter. Adapter must have getDrizzle() method.`
+    );
+  }
+  const container = new ServiceContainer(adapter);
+  const permissionService = container.permissions;
+  let created = 0;
+  let skipped = 0;
+  let errors = 0;
+  const errorMessages = [];
+  for (const resource of resources) {
+    log(`\u{1F4E6} Processing resource: ${resource}`);
+    for (const action of actions) {
+      const name = `${action.charAt(0).toUpperCase() + action.slice(1)} ${resource.charAt(0).toUpperCase() + resource.slice(1)}`;
+      const slug = `${action}-${resource}`;
+      const description = `Permission to ${action} ${resource}`;
+      try {
+        const validation = CreatePermissionSchema.safeParse({
+          name,
+          slug,
+          action,
+          resource,
+          description
+        });
+        if (!validation.success) {
+          const errorMsg = `Schema validation failed for ${resource}:${action}: ${validation.error.issues.map((i) => i.message).join(", ")}`;
+          errorLog(`  \u274C ${errorMsg}`);
+          errorMessages.push(errorMsg);
+          errors++;
+          continue;
+        }
+        const result = await permissionService.ensurePermission(
+          action,
+          resource,
+          name,
+          slug,
+          description
+        );
+        if (result.created) {
+          log(`  \u2705 Created: ${resource}:${action}`);
+          created++;
+        } else {
+          log(`  \u23ED\uFE0F  Skipped (exists): ${resource}:${action}`);
+          skipped++;
+        }
+      } catch (error) {
+        const errorMsg = `Error creating ${resource}:${action}: ${error instanceof Error ? error.message : String(error)}`;
+        errorLog(`  \u274C ${errorMsg}`);
+        errorMessages.push(errorMsg);
+        errors++;
+      }
+    }
+    log("");
+  }
+  log("\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501");
+  log("\u{1F4CA} Seeding Summary:");
+  log(`  \u2705 Created: ${created}`);
+  log(`  \u23ED\uFE0F  Skipped: ${skipped}`);
+  log(`  \u274C Errors: ${errors}`);
+  log(`  \u{1F4DD} Total: ${created + skipped + errors}`);
+  log("\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n");
+  const success = errors === 0;
+  if (success) {
+    log("\u2728 Permission seeding completed successfully!");
+  } else {
+    errorLog(
+      "\u26A0\uFE0F  Some permissions failed to seed. Please check the errors above."
+    );
+  }
+  return {
+    success,
+    created,
+    skipped,
+    errors,
+    total: created + skipped + errors,
+    errorMessages: errorMessages.length > 0 ? errorMessages : void 0
+  };
+}
+
+export {
+  seedPermissions
+};

package/dist/chunk-UUOFWCM6.mjs

@@ -0,0 +1,78 @@
+import {
+  readAccessTokenCookie,
+  verifyAccessToken
+} from "./chunk-2ZFKXPQM.mjs";
+import {
+  JWT_INTERNAL_CLAIMS
+} from "./chunk-X23WKS3Z.mjs";
+
+// src/auth/session/get-session.ts
+async function getSession(request, secret) {
+  const token = readAccessTokenCookie(request);
+  if (!token) {
+    return { authenticated: false, reason: "no_token" };
+  }
+  const result = await verifyAccessToken(token, secret);
+  if (!result.valid) {
+    return {
+      authenticated: false,
+      reason: result.reason === "expired" ? "expired" : "invalid"
+    };
+  }
+  const user = payloadToSessionUser(result.payload);
+  return { authenticated: true, user };
+}
+function payloadToSessionUser(payload) {
+  const user = {
+    id: payload.sub,
+    email: payload.email,
+    name: payload.name,
+    image: payload.image,
+    roleIds: payload.roleIds || []
+  };
+  const knownClaims = /* @__PURE__ */ new Set([
+    ...JWT_INTERNAL_CLAIMS,
+    "sub",
+    "email",
+    "name",
+    "image",
+    "roleIds"
+  ]);
+  for (const [key, value] of Object.entries(payload)) {
+    if (!knownClaims.has(key)) {
+      user[key] = value;
+    }
+  }
+  return user;
+}
+function hasRole(user, roleSlug) {
+  return user.roleIds.includes(roleSlug);
+}
+function hasAnyRole(user, roleSlugs) {
+  return roleSlugs.some((slug) => user.roleIds.includes(slug));
+}
+function hasAllRoles(user, roleSlugs) {
+  return roleSlugs.every((slug) => user.roleIds.includes(slug));
+}
+
+// src/auth/session/refresh.ts
+import { randomBytes, createHash } from "crypto";
+function generateRefreshToken() {
+  return randomBytes(64).toString("hex");
+}
+function hashRefreshToken(token) {
+  return createHash("sha256").update(token).digest("hex");
+}
+function generateRefreshTokenId() {
+  return `rt_${randomBytes(16).toString("hex")}`;
+}
+
+export {
+  getSession,
+  hasRole,
+  hasAnyRole,
+  hasAllRoles,
+  generateRefreshToken,
+  hashRefreshToken,
+  generateRefreshTokenId
+};